Circular quantum secret sharing 



Fu-Guo Deng, 1 - 2 ' 3 ' 4 * Hong-Yu Zhou, 1 ' 2 ' 3 and Gui Lu Long 4 - 5 t 
1 The Key Laboratory of Beam Technology and Material Modification of Ministry of Education, 
Beijing Normal University, Beijing 100875, China 
2 Institute of Low Energy Nuclear Physics, and Department of Material Science and Engineering, 
Beijing Normal University, Beijing 100875, China 
Beijing Radiation Center, Beijing 100875, China 
4 Key Laboratory For Quantum Information and Measurements of Ministry of Education, 
and Department of Physics, Tsinghua University, Beijing 100084, China 
5 Key Laboratory for Atomic and Molecular Nanosciences, Tsinghua University, Beijing 100084, China 

(Dated: February 1, 2008) 

A circular quantum secret sharing protocol is proposed, which is useful and efficient when one 
of the parties of secret sharing is remote to the others who are in adjacent, especially the parties 
are more than three. We describe the process of this protocol and discuss its security when the 
quantum information carrying is polarized single photons running circularly. It will be shown that 
entanglement is not necessary for quantum secret sharing. Moreover, the theoretic efficiency is 
improved to approach 100% as almost all the instances can be used for generating the private key, 
and each photon can carry one bit of information without quantum storage. It is straightforwardly 
to utilize this topological structure to complete quantum secret sharing with multi-level two-particle 
entanglement in high capacity securely. 

PACS numbers: 03.67.Hk, 03.67.Dd, 03.65.Ud, 89.70.+C 



I. INTRODUCTION 

Secret sharing is a useful tool in classical secure com- 
munication [3, 0] . It can be used to accomplish a special 
task. Suppose a president of a bank, Alice wants to send 
a secret message to her two agents, Bob and Charlie who 
are at a distant place for carrying out a business on her 
behalf. Alice cannot determine whether both of them 
are honest. There may be at most one dishonest agent 
among Bob and Charlie pair, but Alice does not know 
who the dishonest one is. She knows that the honest one 
will keep the dishonest one from destroying the business 
if they coexist in the process of the business. For the se- 
curity of the secret message (Sa), she will split it into two 
pieces, Sb and Sc, and only sends one to Bob and an- 
other to Charlie respectively. The two pieces of message 
can be used to reconstruct the secret message Sa when 
Bob and Charlie collaborate, otherwise none of them can 
get any useful information about Sa- 

Cryptography can be used to complete the task if Alice 
created a private key Kb (Kc) with Bob (Charlie). For 
example, if Alice wants to send the message Sb to Bob 
securely, she can encrypt the message Sb with the private 
key Kb using the one time-pad crypt-system and then 
send the ciphertext Cb — Sb © Kb to Bob, where © 
means modulo 2 summation. With the key Kb, Bob can 
decrypt Cb to read out the message Sb, but any one 
else can not obtain anything about it. Similarly, Alice 
can encrypt the message Sa with Ka = Kb © Kc, i.e., 
Ca — Sa © Ka, and then sends the ciphered text Ca 
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to both of Bob and Charlie. They can get the original 
message Sa only when they collaborate. In essence, this 
is the classical secret sharing whose security depends on 
the privacy of the key Kb and Kc- The distribution of a 
private key between two remote parties or multi-parties 
is important for secure communication. 

Quantum key distribution (QKD) is an important ap- 
plication of quantum mechanics within the field of in- 
formation, and it provides a secure way for generating 
a private key between two remote parties since Ben- 
nett and Brassard [1, Q- The secret sharing has been 
generalized to the quantum scenario by using entangle- 
ment namely quantum secret sharing (QSS). Dif- 
ferent from classical secret sharing, the shared informa- 
tion in QSS can be both classical and quantum. In par- 
ticular, QSS is useful for creating a private key among 
multi-party of secure communications . There have 
been man y th eoretical and experimental interests in QSS 
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A pioneering QSS scheme called HBB99 scheme, 
was proposed by Hillery, Buzek and Berthiaume in 1999 
by using three-particle entangled Greenberger-Horne- 
Zeilinger (GHZ) states. In this scheme, the bank presi- 
dent, Alice prepares a GHZ triplet state 

\iP) abc = i(|ooo) o6c + llll),^), (1) 

where the state |0) and |1) are two eigenvectors of two- 
level quantum system, such as the polarization of single 
photons along the z-direction (a z ). Alice sends the par- 
ticle b and c to Bob and Charlie respectively, and keeps 
the particle a. They all agree that they choose randomly 
one of the two measuring bases (MBs), a x and a y to 
perform the measurement on their particles. When they 
all choose a x or one chooses a x and the others choose 
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a y , their results are correlated and will be kept for key, 
otherwise they discard the results. Its intrinsic efficiency 
for qubits e q , the ratio of number of valid qubits to the 
number of transmitted qubits, is about 50% as half of 
the instances will be abandoned. Subsequently, Karls- 
son, Koashi and Imoto (KKI) put forward a QSS scheme 
H with two-photon polarization-entangled states, and its 
efficiency e q is also 50%. 

There is a common feature in the existing QSS proto- 
cols^ instancy in Refs. @, i, S, 0, i, U M, M, El 
El 111 El EE EE El HI, that the quantum informa- 
tion carrier (QIC) runs only between two parties among 
the participants, i.e., from Alice to Bob, and from Alice 
to Charlie in three-party secret sharing, no transmission 
between Bob and Charlie. In general, Alice is remote to 
both Bob and Charlie, and Bob and Charlie are likely 
two adjacent agents. Then they can complete a QSS by 
making the QIC run a circle, namely, the QIC runs from 
Alice to Bob, and then from Bob to Charlie, finally back 
to Alice. Though the change in the process seems small, 
but it reduces the resource requirement greatly and the 
intrinsic efficiency is also increased. In this paper, we 
will present a quantum secret sharing protocol of classi- 
cal information based on the circular motion idea using 
polarized single photons. This basic circular transmission 
idea is not restricted to the use of single photons, but also 
could be used in other systems and the generalization of 
the protocol with entangled states is also presented. 



Rc respectively. If they choose the coding mode, they 
perform randomly one of the two unitary operations, Uq 
and Ui which represent the bits and 1 respectively, on 
the single photon received, 



U = |0>(0| + |1)(1|, 
U, = |0)(1|-|1)(0|. 
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The operation Uq is the identity operation and does 
nothing on the single photon. The nice feature of the U\ 
operation is that it flips the state in both measuringbasis: 
U\ negates the states in the two conjugate MBsfH l26| . 
i.e., 



-z) = -\-z), U x \-z) = 
■x) = \-x), Ui\ - x) = - 



classical channel 
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II. CIRCULAR QUANTUM SECRET SHARING 
WITH POLARIZED SINGLE PHOTONS 



A. The circular-QSS protocol with single photons 

The basic idea of the circular-QSS protocol with polar- 
ized single photons is shown in Fig.l. The president, Al- 
ice prepares the QICs which are polarized single photons 
in this QSS protocol, using two sets of measuring basis 
(MB) into one of the following four states randomly 
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where 



-z) = ID 



(2) 



(3) 



\+x) = — (|0> + |1», 



= _(|0>-|1», (4) 



respectively. The states | ± z) and | ± x) are the eigen- 
states of <y z and a x , respectively. Before the quantum 
communication, Alice, Bob and Charlie agree that Bob 
and Charlie choose randomly the control mode or the 
coding mode for the quantum signal received, similar to 
the Ping-Pong quantum key distribution scheme in Refs. 
[HHIll- When they choose the control mode, they per- 
form single-photon measurement on the signal using one 
of the two MBs, a z and a x randomly and record the MBs 
and outcomes of the measurements, denoted as Rb and 



FIG. 1: Circular quantum secret sharing. The quantum 
information carrier runs from Alice to Bob, then to Charlie, 
and finally back to Alice. Bob and Charlie randomly choose 
the control mode or the coding mode for each signal. The full 
line represents the quantum channel and the dashed line for 
classical channel. 



For creating the private key Ka, Alice sends the quan- 
tum signal to Bob first, and Bob chooses the control mode 
or the coding mode randomly for each photon. If he 
chooses the control mode, Bob performs measurement 
on the photon. Otherwise, he codes the photon with the 
two unitary operations Uq and Ui chosen randomly and 
then sends it to Charlie. Charlie performs the operation 
in a way just like Bob. He sends the photon to Alice after 
coding with unitary operations if he chooses the coding 
mode. Alice performs single-photon measurement on the 
photon received with the same MB as she prepares it. 
As the two unitary operations Uq and Ui do not change 
the MB, Alice can get a deterministic outcome for each 
photon returned, e.g., Ua = Ub® Uq, where Ub and Uc 
are the operations done by Bob and Charlie on the same 
photon respectively, Ua is the total operation on photon. 

In order to prevent any eavesdropper from getting the 
information about the key Ka which is represented by 
Ua when the parties confirm that the whole process of 
quantum communication is secure, Alice, Bob and Char- 
lie should sample instances twice for analyzing the error 
rates. The first sequence of the samples are those that 
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have been chosen and measured by Bob or Charlie when 
they choose the control mode. It can be divided into 
two parts: one contains those measured by Bob, denoted 
by sib', the other contains those measured by Charlie, 
say si c . The second sample sequence are randomly cho- 
sen from those instances that returned back to Alice, de- 
noted by S2- In this second sample sequence, Bob and 
Charlie both choose the coding mode, and hence accord- 
ingly their coding operations form two coding sequences 
denoted by S2b and S2 C . 

For analyzing the error rate in samples si;,, Bob pub- 
lishes the information about the samples sib, including 
the positions of the measured photons in the photon se- 
quence he receives from Alice, the MBs and the results of 
the measurements in sib, and Alice compares it with the 
information of these photons. In those cases where Bob 
has chosen the same measuring-basis as Alice's, Alice can 
determine the error rate e lb . 

The error rate of the sample sequence si c , denoted 
as £ lc , can be similarly determined by Alice and Charlie. 
But here Charlie first announces the positions of s\ c pho- 
tons, and then Bob is asked to publish his unitary oper- 
ations he performs on these photons, then Bob publishes 
the outcome of his measurement and the corresponding 
measuring-basis . 

To analyze the error rate in the second sample sequence 
S2, Alice asks Bob and Charlie to publish the unitary 
operations of the sampled photons in the sequence. Since 
Alice's result should be the product of unitary operations 
of Alice and Bob, Alice can determine the error rate from 
the announcement of Bob and Charlie. 

With these eavesdropping checks, eavesdropper will be 
detected if he or she has monitored the quantum channel. 
The details will be discussed shortly. 

In practical, there are noise and loss in the quantum 
channel. The methods for error correction and privacy 
amplification are necessary for distilling the key Ka — 
K B ® K c , same as QKD [a. [27j. 



B. Security analysis of the QSS protocol with 
single photons 

Suppose the dishonest one between Bob and Charlie 
is denoted as Bob*. As discussed in Ref. if the dis- 
honest one Bob* can be detected by the other two par- 
ties, say Alice and Charlie* when he/she eavesdrops the 
quantum communication, then any eavesdropper can be 
found out. We will discuss the security of this circular 
QSS protocol in two cases with Bob* being Bob, and 
Charlie respectively. 

If Bob* is Bob, the security of this QSS protocol is 
simplified to prevent Bob from eavesdropping the secret 
key Ka- In fact, the task of eavesdropping check is to 
determine whether Bob obtained the information about 
the unitary operations Uq which is just the key Kc un- 
der ideal condition. Any other cheat done by Bob in the 
process of quantum communication will be found out in 



secret sharing if Bob cannot get the information about 
the Uq- The fake information that Bob publishes about 
his operations Ub on s\ c will be exposed as it was an- 
nounced before Charlie publishes the MBs and the results 
for si c . In this way, the process for security analysis be- 
tween Alice and Charlie is equal to that in BB84 QKD 0] , 
which is proved unconditionally secure, for example, see- 
ing Refs. [23, |29j, [30( • We can calculate the information 
1b that Bob can obtain about the unitary operations Uc 
done by Charlie with the probability of being detecte d e „ 
as follows, in a way similar to those used in Refs. [23Ll3l|. 

We discuss the security in the case that any eaves- 
dropper can only make individual attacks. The reason 
is discussed in Refs. [H, S3, S3, S3]- As discussed in 
Ref. [2l|, the limitation on the error rate introduced by 
Bob's eavesdropping is 25% for which Bob intercepts the 
quantum signal Alice sends to Charlie and sends a fake 
photon to him. The purpose that Bob eavesdroppers 
the quantum signal is to learn more information about it 
and introduces as little error as possible into the results. 
The error rate introduced by Bob comes from the wrong 
MBs chosen, i.e., Alice prepares the quantum signal with 
a z , but Bob chooses a x for eavesdropping, or vice versa 
[32| . We assume that Alice prepares the quantum states 
with <j z and Bob with a x for eavesdropping (the condi- 
tion that Alice chooses a x and Bob a z is the same for the 
security analysis). In this way, the information stolen by 
Bob about the state of the photon coded is equal to that 
about the operation done by Charlie [23j. 

The optimal individual attack done by an eavesdropper 
can be realized by a unitary operation Ub on the photon 

d3, S3, S3, S3, S3, Si, SI, [H3, S3, Ssl with an andiia 

whose initial state is |0). 

C7 E |0)|0) = |0)|0), (9) 
C7 E |1)|0) = cos0|l)|O) + sin0|O)|l>, (10) 

where <fi G [0, j] characterizes the strength of Eve's attack 
& 

The probability e B that Bob will be detected is same 
as the error rate introduced by the eavesdropping [13 S3] • 
As Alice makes the photon in the four states { | + z) , | — 
z), | +x), I —_%)} with the same probability, then the error 
rate is [2g, [33| 

£ B = \ sin2 <t>- ( n ) 

The state of the photon that Alice prepares can be 
described with a density matrix 

pA = \n^\ + \\i){i\. (12) 

After Bob's eavesdropping, the joint state -0s of the 
system 3 composed of the photon A and the ancilla 
[23l S3, S3 P can be written as 

p AP = i{|OO)(OO| + cos 2 0|lO)(lO| + cos?!)sm*0|lO)(Ol| 
+ sm</>cos*0|Ol)(lO| + sm 2 0|Ol)(Ol|}, (13) 
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where \ij) = |«)a|j)p, i,j € {0,1}- The effect of the 
unitary operations done by Charlie is just to change the 
state of the photon A in p AP . Suppose the probabilities 
that Charlie chooses Uo and U\ are P c q and P c \, respec- 
tively. After the coding, the state ipQ becomes 

1 



= -{P c0 |00)(00| 



P c i 1 10) (10 1 

+ P cO [cos 2 0|lO)(lO| + cos sin* 0| 10) (01 1 

+ sin^cos*0|Ol)(lO| + sin 2 0|Ol)(Ol|] 

+ P c i [cos 2 0|OO> <00] - cos (psin* <f>\ 00) (11 1 

- sin(/)COS*0|ll)(OO| + sin 2 0|ll)(ll|]}. (14) 

As Bob wants to eavesdrop the quantum communication 
for creating a private key, he should send the photon 
coded to Alice and only measure the ancilla. which is 
different to that for direct communication [23|, [3l| • We 
can trace out the state of the photon A from the joint 
state ips with MB a z ({|0), |1)}) to get the state of the 
ancilla, p' , 



1 



{(1 + cos 2 </>) 1 0)(0| + sin 2 </>|l)(l|}, (15) 



which can be projected to orthogonal measuring basis 
{|0), |1)} (it is one of the best measurements for distilling 
the information from the state) and written as 



1 + cos 2 4> 








(16) 
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FIG. 2: The relation between I„ and e. 



The information Is that Bob can obtain is equal to the 
Von Neumann entropy of the state of the ancilla. And 
the Von Neumann entropy can be calculate as follows 

MM. 



S(p'') = -Tr(p"log2p"), 



(17) 



J B = S(p"p) = A ^°-92^ 



(18) 



where \ (i = 0, 1) are the roots of the characteristic 
polynomial det{p" p — XI) (23j , yielding the two eigenvalues 



A = -(1 + cos 2 , 



Ai = - sin 2 
2 



(19) 



(20) 



So we have 



>s 2 4>) log 2 (l + cos 2 (j)) ■ 
= -e B log 2 e B -(l-e B )log 2 (l-e B ). 



sin 2 (j) log 2 sin 2 <f\ 



(21) 



The relation between I B and e B is shown in Fig. 2. It 
is shown in the figure that Bob has to face a detection 
probability e B > if he wants to gain information I B > 
0. If I B is not small, Bob will be detected, otherwise 
Alice and Charlie can distill the key Kc with privacy 
amplification. 

If the Bob* is Charlie, the process of eavesdropping 
check for the sample sequence si;, is same as in the BB84- 

QKD protocol HIHEIiliiJ- The state P A " of the P hoton 
prepared by Alice is random for Charlie as she chooses 
randomly one of the two MBs a z and a x for it. 



z){-z\ + - A \+x){+x\ 
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The operation Ub done by Bob on the photon does not 
change the character of the state for Charlie as 
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(23) 



where p,o and Pbi are the probabilities that Bob chooses 
the unitary operations Uq and U\, respectively. No mat- 
ter what quantum signal Charlie eavesdrops, the security 
analysis is same as BB84-QKD So this QSS is secure 
if Bob* is Charlie. 

Bob* may cheat in the communication, for instance 
he publishes a wrong information about his unitary op- 
erations Ub*, or he does not use the right key Kb* in 
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secret sharing. Inevitably, his action can be detected. 
For example, the wrong information about his unitary 
operations will be found out when Alice and Charlie com- 
pare the results in S2 C * in quantum secret sharing. Af- 
ter the key Ka — Kb © Kq is created, the cheat that 
Bob* does not use Kb* for decrypting the ciphered text 
Ca = Sa © Ka can also be detected before the Ca is 
transmitted. Alice, Bob and Charlie need only determine 
whether the key K' A = K' B © K' c obtained by combin- 
ing Bob's key and Charlie's key when they cooperate is 
identical to her key Ka obtained by Alice's measurement 
before she sends a secret message to her two remote assis- 
tants, Bob and Charlie. The process can be achieved by 
choosing at random a sufficiently large subset of bits in 
the key K' A to compare the results with those in the key 
Ka- If the error rate is zero, Alice confirms that there is 
no dishonest one in Bob and Charlie pair, and she sends 
the secret message to them after encrypting it with the 
key Ka; otherwise she has to abort the secret message 
communication. 

The parties encode the photons with unitary opera- 
tions and each photon can carry one bit of information 
in Ka in principle. The efficiency for qubit is improved 
to approach 100%. Moreover, they do not exchange the 
information about the MBs for almost all the instances, 
and they also need not store the single photons. 



quantum state storage [46J, |47J, |48j. We will generalize 
this circular QSS with Einstein-Podolsky-Rosen (EPR) 
pairs, two-particle maximally entangled states, following 
the ideas in dense coding [40] - The case for other multi- 
level two-particle entanglement is just the same as it. 
An EPR pair can be in one of the four Bell states 

MM, 
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The four local unitary operations Uli {i — 0, 1, 2, 3) can 
transfer the four Bell states into each other. 



Ulo = 1= |0)(0| + |1)(1|, 

U L1 = ^ = |0)(1|-|1)<0|, 

U L2 = <7 a = |l>(0| + |0><l|, 

U L3 = <t* = |0) <0| - |1) (1| , 



(31) 
(32) 
(33) 
(34) 



III. CIRCULAR QUANTUM SECRET 
SHARING WITH MULTI-LEVEL 
TWO-PARTICLE ENTANGLEMENT 

For two-particle quantum system, d-dimension Bell- 
basis states in a symmetric quantum channel are 0,0, 

|*„m) = Yl e 2 ^ n / d \j) <8> \j + m mod d)/Vd, (24) 



where n, m = 0, 1, d — 1. The unitary operations 

U nm = e2m3n ' d b' +m mod d)(j\ (25) 

3 

can transform the Bell-basis state 

|*oo> = ® (26) 

3 

into the Bell-basis state |* nm ), i.e., U nm \V 00 ) = |*„ m ). 
For two-party communication, one particle can carry 
log 2 d 2 bits of information while running forth and back. 
In a more generalized case, non-symmetric quantum 
channel is possible where the two particles of the en- 
tangled quantum system have the different dimensions 
[44l |45|. for example, the first particle has p dimensions 
and the second one has q dimensions. Then the capacity 
is log 2 pq. 

The source coding capacity of this circular QS S can be 
improved largely with super-dense coding [40j, |43| . |44| and 



I^Ulo]^) 
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The process of this QSS with EPR pairs is similar to 
that with single photons discussed above. The president, 
Alice prepares the two-particle entangled state \iI>~)ht, 
and she keeps the particle H and sends the particle T to 
Bob first, shown in Fig.l. He chooses the control mode 
and the coding mode randomly. When Bob chooses the 
coding mode, he performs one of the four unitary opera- 
tions Ulz (i = 0,1,2,3) which represent the bits 00, 01, 
10 and 11 respectively, on the particle T randomly. Oth- 
erwise, he chooses the two MBs, a z and a x to measure the 
particle T, and tells Alice which particle he chooses the 
control mode. Alice does the correlated measurement on 
the particle H in the EPR pair in which Bob measures 
the particle T, that is, Bob tells Alice the position of 
the particle and his MB for it, and Alice performs the 
measurement with the same MB as Bob on the particle 
H. 

As for Charlie, after he receives the particle Bob sends 
to Charlie after coding with an unitary operation, Charlie 
chooses randomly the control mode and the coding mode. 
If he chooses the coding mode, he performs randomly one 
of the four coding operations and then send the particle 
to Alice. When Bob chooses the control mode, he mea- 
sures the particle choosing randomly one of the two MBs 
a z and a x . 
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The eavesdropping check can be adapted here straight- 
forwardly. In fact, no matter who the dishonest Bob* is, 
the way for checking the security of quantum communi- 
cation is same as that for the BBM-QKD (H^j which has 
been proven unconditionally secure for key generation 
[34l l5l|. As pointed out by Bechmann-Pasquinucci and 
Peres [52[, the QKD with multi-level quantum system is 
more secure than that with two-level one. 



IV. DISCUSSION AND CONCLUSION 

In general, QSS is accomplished with entanglement, 
which normally requires more complicated experimental 
setups. Though big progress has been made for produc- 
ing and measuring entanglement, the efficiency is still low 
[53, HH . QSS with single photons will be more conve- 
nient for being implemented in laboratory and practical 
application. On the other hand, the source coding ca- 
pacity of QSS can be improved largely with super-dense 
coding in which entanglement is necessary. With devel- 
opment of technology, it is likely feasible to implement 
QSS based on entanglement, especially with multi-level 
entanglement in high capacity. 

Certainly, another important function of QSS is to split 
a secret message into n pieces and completes the task of 
an m — out — of — n quantum secret splitting scheme, 
or so-called (to, n) threshold scheme Unfortunately, 
this circular QSS scheme can not be used to accomplish 
the full goal of quantum secret splitting. That is, it can 
not be used for to — out — of — n scheme in which any 
to parties can reconstruct the secret message when they 
collaborate. However, it is useful for accomplish a partial 



goal, n — out — of — n scheme. In other words, the circular 
QSS can be used to reconstruct the secret message when 
all of the other n parties cooperate with some classical 
information published by Alice, the president. 

In summary, a circular QSS scheme is proposed. It is 
useful and efficient when the president Alice is remote 
to all her agents, Bobs who are in adjacent, especially 
the parties of secret sharing are more than three. In this 
scheme, the quantum information carrier, single photons 
or entangled particles, will run circularly, and the par- 
ties choose randomly the control mode or coding mode 
to operate the QIC. They measure the QIC only when 
they choose control mode, otherwise, they encode the 
QIC with some unitary operations. If the QIC is single 
photon, all the parties of communication including Alice 
do not need to store the quantum state. If the QIC is 
entangled quantum system, only Alice is required to pos- 
sess the technique of quantum storage, others need not. 
This is convenient for realizing QSS in practical applica- 
tion. Moreover, each QIC can be used to carry informa- 
tion except for the samples for eavesdropping check, and 
classical information exchanged is reduced largely as the 
parties need not announce the MBs for the QIC. 
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